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3, REMARKS 

Applicants wish to thank the Examiner for having done such a thorough job not only of 
reviewing the claims and studying the prior art but also of studying the drawings and the 
specification of this lengthy patent application, pointing out defects that truly do need to be 
addressed. Also, applicants wish to thank the Examiner for having reviewed the claims of 
several other related applications that are continuations or continuations-in-parts of the present 
application. There are seven such related applications, and for the Examiner's convenience, 
copies of their claims are set forth in an Appendix B of this response. 

After carefully studying the Examiner's rejection, the specification and drawings, the 
claims filed with this application, and the claims in other applications which the Examiner has 
pointed out in his double-patenting rejection; and after preparing corrections to the specification 
and drawings; applicants have elected to cancel all of the claims 1 to 23 originally filed with this 
application and to prepare three entirely new sets of claims (method, system, and "means for" 
system) for consideration by the Examiner. These newly-submitted claims are directed in general 
toward the inventions claimed by the cancelled claims 1 1 and 18. They have been carefully 
crafted with all the Examiner's objections in mind in a good faith effort to seek out an allowable 
set of claims for this application. 

Applicants respectfully request that all of the foregoing amendments be made prior to 
examination of the present application. Applicants also respectfully request reconsideration of 
the present application, and its newly-submitted claims, in view of the foregoing amendments 
and in view of the reasons set forth below. 

A. Corrections Made To The Drawings 

In the drawings, formal drawings have been submitted, revised so that the figure 
identification labels have the same style on all of the drawing sheets. In addition, Figures 2, 16, 
and 23 have been amended as is indicated in the annotated copies of the previously-submitted 
drawing sheets, which appear in Appendix A. All of the Examiner's objections to the drawings 
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have been addressed and corrected, either by these corrections or by the addition of reference 
numbers to the specification text. 

In particular, the box in Figure 16 that lacked a reference number now has the reference 
number 1606, which appears in paragraph 173. In Figure 23, the number 2210 and its connecting 
line have been corrected. And the description now specifically mentions the reference number 
1406 (in Figure 14) in amended paragraph 158, to which a sentence has been added containing 
the reference number 1406 as well as text substantially derived from the descriptive label applied 
the box 1406 in Figure 14. The label in the box 1406 reads: "MANAGER OF ANALYZER 
ISSUE LOOKUP TABLES RELATING ANALYZER TO ISSUES" while the sentence newly 
added to paragraph 158 reads: "A manager 1406 may also be provided that manages analyzer 
issue lookup tables which relate analyzers to specific issues." Since this newly-added language 
was taken from Figure 14 with very little change, it does not constitute new matter. 

B. Corrections Made To The Specification 

In the specification, paragraphs 49, 81, 100, 122, 126, 127, 130, 131, 132, 133, 134, 143, 
150, 158, and 201 have been amended. All of the Examiner's objections to the specification 
have been addressed, and other corrections have been made as well. 

The Examiner objected, with respect to paragraph 49, that: "The analyzer harness on 
page 8 is not in FIG. 21. Is should be identified as item 806 in FIG. 2." With all due respect, this 
is not correct - the analyzer harness 806 does appear in Figure 21, and it is correctly labeled as 
item 806 in that figure. In Figure 21, the analyzer harness 806 is indicated by a dashed line, 
correctly labeled 806, that encloses most of the other elements in Figure 21 . The elements 2102, 
2104, 2106, 21 10, 21 12, 21 14, 21 16, 2124, and 2126 all fall within, and form parts of, the 
analyzer harness 806. In response to this objection, applicants have amended paragraph 48 to 
clarify that the analyzer harness 806 appears in all three of the drawing Figures 2, 8, and 21, and 
that its details appear in Figure 21. In addition, applicants have also amended the preceding 
paragraph 47 to indicate more clearly that the drawing Figure 21 is actually a detailed drawing of 
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the analyzer harness 806 and of its elements. Applicants hope that this explanation, together 
with these clarifying amendments, will satisfy the Examiner fully. 

The Examiner also indicated that "The link between the analyzer server 800 and 
enterprise 300 on page 13 [0081] is not visible." Actually, this linkage is shown in Figure 2, but 
the linkage is not a direct linkage - it passes through and includes a tracker database 106, as can 
be seen in Figure 2. In response to this objection, applicants have corrected Figure 2 (by adding 
the reference number 323 to the line connecting the elements 104 and 106) and has also corrected 
paragraph 81 of the specification (as indicated below) to clarify the description, without adding 
any new matter beyond what is clearly shown in Figure 2. As corrected, the drawing and this 
paragraph make it clear that: 

[0081] .... The analyzer server 800 is linked to the enterprise 300 via an ISDN 
line or some other form of wide area network 323 and by a tracker database 106 within an 

HAO server 105 Files of configuration information generated by the collectors 104 

of the enterprise 300 are saved in the [[a]] tracker database 106. These files are retrieved 
from the tracker database 106 by an analyzer harness 806 within the analyzer server 800, 
as is described below. 

In compliance with the Examiner's requirement, Applicants have found and corrected all 
incorrect references to "auditor 813" and to "content expert 812". 

The one remaining correction made to paragraph 158 was made in response to one of the 
Examiner's objections to the drawings, namely, his objection that the reference number 1406 was 
not referred to at all in the description. (This correction was explained above.) 

C New Claims Presented 

All of the claims 1 to 23 in the application as filed have been cancelled. New claims 24 
to 42 are presented for the Examiner's consideration. Included are three sets of claims: 
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Independent computerized method claim 24, accompanied by dependant 
computerized method claims 25 to 29 and by a narrow, independent computerized 
method claim 30; 

Independent computerized system claim 3 1 , accompanied by dependant 
computerized system claims 32 to 36 and by a narrow, independent computerized system 
claim 37; and 

Independent "means for" computerized system claim 38, accompanied by 
dependant "means for" computerized system claims 39 to 41 and by a narrow, 
independent "means for" computerized system claim 42. 

D. Rejection of the Claims under 35 USC Section 112 

The Examiner has rejected all of the claims as failing to comply with the enablement 
requirement, stating: "The claim(s) contains subject matter which was not described in the 
specification in such a way as to enable one skilled in the art ... to make and/or to use the 
invention." (Page 5, Office communication mailed 11/19/03) 

Applicants respectfully request reconsideration of this grounds for rejection. The present 
invention, as described in the specification and drawings and as now claimed in the newly- 
submitted claims, is a system and method for monitoring automatically the hardware and 
software configurations of large numbers of networked computers (personal computers or servers 
or both) in enterprises. In particular, the present invention provides a simple and practical way in 
which very simple computer programs, called "analyzers" in the specification and in the claims, 
and written to analyze the configuration of just one single computer, can without the need for any 
more programming have their applicability greatly expanded so that they may be automatically 
applied to hundreds or even thousands of computers located at many different sites. 
Accordingly, the present invention reduces the very difficult task of writing a highly 
sophisticated data gathering, data testing, and report generating program that can monitor the 
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configurations of thousands of different computers at many sites to the much simpler task of 
writing very simple "analyzer" programs for each data gathering operation or test on the 
simplifying assumption that only one computer is being tested (when in reality many computers 
will be tested without the need for further programming). 

As to practical applications of the invention, throughout the patent specification and its 
appendices, an exemplary analyzer is described that checks the disk space available on each 
mounted local hard disk drive of a computer, flagging as an issue any hard disk drive that has 
very little room left for additional data. This analyzer's executable code is presented in 
Appendix B of the application, and it contains only 53 lines of executable program code. There 
is no code in this program that defines how the program is to retrieve data from thousands of 
different computers. This code in Appendix B of the application simply analyzes some of the 
configuration data that is taken from a single computer. Yet, when this analyzer is applied in 
accordance with the teachings of the present invention and as claimed in the newly-submitted 
claims, this simple program is able to analyze the configuration of hundreds or even thousands of 
computers fully automatically, testing all of their hard drives and reporting any issues requiring 
the attention of the network manager, without the need for any additional programming. 

The specification goes on to describe 25 additional practical applications of analyzers. 
Here are a few examples: 

Paragraph 203 describes an analyzer which checks to see that there are both a primary and 
an alternate boot disk for every computer, and to insure that the two boot disks are not installed 
on the same hardware path. An issue is flagged if there is only one boot disk or if both are 
installed on the same hardware path. 

Paragraph 212 describes an analyzer which tests memory by checking for the existence of 
single and double bit errors in a computer's hardware logs, among other things. 
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attached to a computer. 

. a computer and reports on .he status of the CPU fans, power supphes, etc.. 
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accordingly respectfully requested. 

*♦«« none of [the claims] are limited to practical 

applications in the technological arts. The Exam 
applicable case law: 

£, biic equation. ,n re ffamerdam, 33 F.3dl354, 

or hardware configuration or both. 
Following the appeal, Wimerrftwi S1 mply cancelled claim 

„ • ,1 Thomas P H Warmerdam on Nov. 1, 1989) 
(U.S. Patent No. 6,089,742 issued to Thomas P. H. 
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According all that is needed ,o overcome .he Warmerdan, Section 101 rejection is a simp,e 
recital of sufficient "computer" elements in the claim's preamble to limit the invention's 
applicability to use in a computer. The present applicants have done the same by includmg, m ^ 
the preambles of all the „ew ly -submi,.ed claims, the limitations "A computerized method" or A 
computerized system." Appiicants submit tat these claims are allowable under the law as 
defined in the Wamterdant decision. If this is still no. sufficient, the Examiner is invited to call 
applicants' attorney to discuss wha. e.se migh. be needed .o overcome .his rejection. 

Applicants submit further that patentability of applicants' invention is also fully 
supported by the case State S,reet Bank and Trust Co. , Signature Financial Group. Inc.. 149 
F.3d 1368 (Fed. Cir. 1998), cert, denied. 525 U.S. 1093 (1999) which case tire Examiner has also 

cited. 

In State Street, the court found to be patentable a computer system that gathered many 
independent buy and sell orders relating to many independent mutual funds, combined these 
orders electronically, and then traded all the orders as if mere were only one mutual fund, thereby 
gaining major benefits. From the market's point of view, there was just one mutual fund buyng 
and selling stock; whereas from the shareholder's p<,in. of view, there were many separate 
mutual funds. The court in State Street held that this use of a computer to prov.de the 
appearance of a single mutual fund to the market and the appearance of many different mutual 
funds to the shareholders is a patentable use of a programmed computer. 

Likewise, in the present invention, .he computer system and its harness arrangement take 
a simple computer program, written by a programmer to test configuration data garnered from 
only one single computer, and apply una. program over and over again to data gathered from 
hundreds or even thousands of different computers. From the programmer's point of v,ew, there 
is only one simple computer that is being tested; but from the point of view of the enterpnse 
manager, the computer system is testing hundreds or thousands of computers and generating 
audi, reports identifying .he issues arising on each individual computer. The present invention ,s 
thus of tire same general type as the State Stree invention, namely an invention that presents the 
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appearance of only one computer being tested to the programmer (similar to State Street 
presenting the appearance of only one mutual fund to the market) and that presents the 
appearance of a machine that can test hundreds or thousands of computers to the enterprise 
manager (similar to State Street presenting the appearance of many mutual funds to the 
shareholders). Applicants submit that the State Street case thus fully supports the patentability of 
the present invention. 

Warmerdam is distinguishable from the present invention in another important way: 
Waarmerdam is a case where a very specific mathematical equation was claimed and preempted 
- a specific set of equations that were actually set forth in Warmerdam 's specification. The 
Court said: "the claim is mathematical in nature." (see 33 F.3d 1354 at 1360). The same may be 
said of the claims and inventions in Allapat (mathenatical calculations used to compute the 
brightness of each pixel in an oscilloscope display), State Street (mathematical equations used 
first to combine and later to separate security purchase and sale records and related tax records), 
and also of the claims and inventions in the early Supreme Court decisions Benson (mathematical 
formula for converting Binary Coded Decimal numbers into true binary numbers) and Diehr 
(Arrhenius's mathematical equation for calculating rubber cure times). The Supreme Court's 
rejection in Benson was summarized as follows: 

... if the judgment below is affirmed, the patent would wholly pre-empt the 
mathematical formula and in practical effect would be a patent on the algorithm 
itself. (Gottshalk v. Benson, 409 U.S. 63, at 71-71, 93 S.Ct. 253 at 257 (1972)) 

Contrary to the facts and claims in all of these cases, there is no specific mathematical 
equation or formula preempted by the present invention and its claims. It is true that the 
"analyzers," which form a claim element, are short computer programs, and they may be called 
algorithms and may perform mathematical operations. But some, if not most, of the analyzers 
disclosed in this application perform no significant mathematical steps, and no specific 
mathematical operations are called for by any of the claims presently before the Examiner. 
Anyone is free to use any "analyzer" computer program in any way they choose, except in 
conjunction with an "analyzer harness" and "collectors" and a "report generator," as claimed. 
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• • eachof*eco„ fli c«in g o 1 aims,e m ainspend 1 ng(seeMPEP822.01). According.,, .he 
containing each ol the commons j nt rtiic time 

However sin ce «re rwo clairas U and ,6 have both been canceUed from the preset 

7 sons unrelated to .he double patenting rejection, there is no longer any confhc 
appl cation for reasons unrelated 10 mc k naten ting 
Z new.y— d claims were drafted wi,h .he inten, of avotdmg any double-patenting 

problems. 

There are ac.ua,.y seven other applications that are continuations or continuation-in-part 

r , „I To assist the Examiner, applicants have added an Append* B to th,s 
of the present apphcatio. To assrs, the ^ ^ 

statutory, exist with respect to these newly-submitted chums. 

F . Rejection of Cain* 1 .. .4 and .7 «o 23 Under 35 U.S.C. Secdon 1 »2 ( b) 

,u • WKune'"! Reconsideration of this rejection, with 
March 15, 1994 to Ching Y. Kung (hereinafter Kung ). Keco 

respect to the newly-submitted claims, is respectfully requested. 

1. Brief Summary of the Claimed Invention 

, u • u«t nitrated in Figure 8 of the drawings (some claim 
The invention, as claimed here, is best illustrated in ngu 

elements appear in Figure 2). 

The present invention, as denned in all the claims 24 to 42, teaches how one can start 

th configurationof selected software or hardware components on jus, one smgle computer. 
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.from an "analyzer database 804" and ate then "harnessed" by 
.neansofan-analyzerhatnessSOe (aterm m many differ ent computets 

(or W302and304",n F . 8 ure2- » M thal each ^er is 

automatically and sequentially executed or ^ 

ftom hu„dredsor— d S ; f :— :lt— on^ed^w^b 
determines whieh analyzers are seated and execut g a 
specific computers. Any unusnal or reportable eve^s of ,n,^ to ^ 

the specification and claims bas a special meamng and ,s defined the 

attention. (Specification, paragraph 67) 
at leas, some of the "issue identificatton reports, the* eomp ^ 

which that particular issue relates. 

• , tn w to 37 and 40 to 42 all include additional limitations 
^d finaUy, clatms 28 to 30, ^ ^ rf ^ ^ 

requiring the issue identificatton reports and (except ^ ^ 

(in.hetssuesdatabaseU.tohefed.ntoareport^ ^es a.base 204, which are 
a,so supplied with report templates (from the report tempta.es an 
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on ri fi so that highly customized and very readable 

f it,, vime Patent's Teachings 
2. Brief Summary of the Kung raicn 

• ai, "host computer 40" that is networked to 
ft. terminals 52, 64, 68, 72, 88, 90, 92 (shared toe) 

m „dems such as the modems 58, 62, 66, an , ^ ^ ^ data 

cab.es (CO,. ,0, toes 30 ,0 33) ,0 .he modems 46, * - ^ ^ ^ 

da *ca W e.oam„,.,p,xer74. The network manag 

ser ial cah.es and through .he same three cen.ra, st.e modems 46 

(C0 , ,0 toes 33 .o 37). Accordtng,, 4 - «• ^ ^ „ „ 43) Dia , 

com m„,c,ew i *.hea,.o f .hemodem. h^ ^' I^of.hisded.ca.edd.a^cne^of 
up and X.25 networks are also suggested for use par. 
modems (Co.. 10, lines 58.0 66). 

t 2er24a ,s„connec.stoane W o*manage,termma,33andprinter34. 
The network manager 24 also conn ^ ^ ^ ^ maMgmg 
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30 (col. 9, toes 51 to 53). In response to troub.e P ^ ^ 
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the telephone company for repairs, (col. 11, toes lOto 
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network over (he RS 232 cable 22 in the J , f ffl .. expe rt system" that is 

— * ^^^eto^-^eKu.P- 
O tre .evance«o.hepres=ntaiscuss,o»,and s tta „ staed thI0Ugh a 

stnlcM rel— ebaseUO. Alarms se « ^ m ta 

response.osucha.arn.MheWerence^e^ ^^^^ere,. ..response, a 

— -outoverthe^osticn— ^ fflanager 124 * h , en places . be 

the inference engine 122. 

3 UeClaimsArePatentableOverKung 

u- nfKunaitcanbeseenthatKung 

does not teach the present invention. 
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First, all of the claims call for providing analyzers "comprising the executable program 
steps needed to compute, from selected configuration information gathered from a single 
computer, a report identifying at least one issue relating to the computer" (Independent Claims 
24, 30, 3 1, 37, 38, and 42). There is no such teaching to be found in the Kung patent. Kung does 
not even teach gathering information from computers — he gathers information only from 
modems and the like. Kung does not teach providing a program written to process data from 
only one device when the intent is to process information gathered from many devices. 

Secondly, all of the claims call for: 

"harnessing each of the ... listed analyzers to configuration information 
gathered from each of the ... listed computers" and then "processing the 
configuration information so harnessed under the guidance of each analyzer's 
executable program steps" (independent method claims 24 and 30); 

"an analyzer harness ... sequentially harnessing each of the ... listed 
analyzers to configuration information gathered from each of the ... listed 
computers and executing each analyzer's executable program steps upon the 
harnessed configuration information" (independent system claims 31 and 37); or 

"analyzer harness means ... for sequentially harnessing ... each of the ... 
listed analyzer means to configuration information gathered from each of the ... 
listed computers, for executing each analyzer mean's executable program steps 
upon the harnessed configuration information" (independent system claims 38 and 
42). 

Kung does not appear to teach this at all. Even in an expert system, additional explicit 
programming of some type is required to cause an expert rule to be applied to specific multiple 
sets of gathered information. In the present invention, the use of task definitions to control the 
operations of the analyzer harness makes such additional programming unnecessary and clearly 
distinguishes the claimed invention from the teachings of Kung. 

Additionally, all of the claims call for a plurality of networked computers and for 
collectors that gather information defining how the hardware or software of the computers is 
configured. Kung does not disclose in his patent any computers networked together - only serial 
interconnections between one host computer and a plurality of terminals. The only "network" he 

-35- 

011.1187090.1 



# 



Atty. Dkt. No. 10015199-1 

discloses is a "secondary diagnostic channel" (col. 10, lines 62 to 66) that is not capable of 
computer-to-computer communication - it is dedicated to the gathering of diagnostic 
information from modems and a multiplexer. There is no teaching in Kung that configuration 
information is to be gathered from anything other than modems, a multiplexer, and "other 
objects" (col. 9, lines 61 to 65). Kung does not teach gathering configuration information from 
computers over a network through the use of collectors. 

The additional requirement in claims 26 to 30, 33 to 37, and 39 to 42 that the "identity of 
the computers whose configuration information was processed" be included within the "issue 
identification reports" generated whenever an analyzer is processed is a requirement not taught in 
the Kung patent. This aspect of the invention permits audit reports to identify each computer 
even though the analyzer programs are incapable of identifying the computers audited. 

And finally, the additional requirement of the claims 28 to 30, 35 to 37, and 40 to 42 that 
the issue identification reports and (except for claim 50) the identity of the computers be fed into 
a report generator 206 which is also supplied with audit report templates (designated by the task 
definitions) is another requirement not taught at any point in the Kung patent. This aspect of the 
invention enables the production of readable audit reports, carefully tailored to the needs of 
specific audiences. 

In view of this, reconsideration of this rejection and allowance of the claims is 
respectfully requested. 

Rejection of Claims 15 and 16 Under 35 U.S.C. Section 103(a) 

These two claims have been cancelled. In the present application, no other claims remain 
that include, as limitations, the required use of XML data structures in the design of an enterprise 
auditing system. Accordingly, this basis for rejection is not applicable to any of the newly- 
submitted claims. Reconsideration of this rejection is accordingly respectfully requested. 

G. Conclusion 
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Applicants believe that the present application, as amended, is now in condition for 
allowance. Early and favorable reconsideration and allowance of this application, as amended, is 
respectfully requested. 

The Examiner is invited to contact the undersigned by telephone if it is felt that a 
telephone interview would advance the prosecution of the present application. 

The Commissioner is hereby authorized to charge any additional fees which may be 
required regarding this application under 37 C.F.R. §§ 1.16-1.17, or credit any overpayment, to 
Deposit Account No. 06-1450. Should no proper payment be enclosed herewith, as by a check 
being in the wrong amount, unsigned, post-dated, otherwise improper or informal or even 
entirely missing, the Commissioner is authorized to charge the unpaid amount to Deposit 
Account No. 06-1450. If any extensions of time are needed for timely acceptance of papers 
submitted herewith, Applicants hereby petition for such extension under 37 C.F.R. §1.136 and 
authorizes payment of any such extensions fees to Deposit Account No. 06-1450. 



Respectfully submitted, 




FOLEY & LARDNER LLP 
321 North Clark Street 
Chicago, Illinois 60610 
Customer Number: 27433 
Telephone: (312) 832-4596 
Facsimile: (312) 832-4700 



Michael D. Rechtin 
Attorney for Applicants 
Registration No. 30,128 



-37- 



011.1187090.1 



Atty. Dkt. No. 10015199-1 

Appendix A 
Annotated Drawing Sheets Showing Changes 



011.1187090.1 




3 
o 

■ 

a 

55 
m 

I 

3 

O 
7) 
■H 
Q 

I 



FIG. 16 REPORT TEMPLATE CREATION 



1600 

/ 



MAKE AVAILABLE TO THE AUTHOR OF A 
REPORT THE SYMBOLIC NAMES TO BE 
USED IN REPORT TEMPLATES 



DEVELOP SETS OF RULES THAT CAN 
REVIEW THE OVERALL PERFORMANCE OF \ 
AN ENTERPRISE 1604 



DEVELOP A MANAGEMENT SUMMARY 
REPORT TEMPLATE THAT STATES, IN A 
READABLE FORM, THE GENERAL STATE 
OF THE SYSTEM 




TO FIG. 17 



FIG. 23 



FROM FIG. 22 



NO 



2212 

^ 



ANALYZER IS 




EXECUTABLE OR 


INTERPRETABLE, ^ 


I.E., C, PERL, OR 




SHELL? 


r 



2216 



LOAD OBJECT AS A 
JAVA EXECUTABLE 



LAUNCH 
EXECUTABLE (C) 
ANALYZER 
PROGRAM 
PROVIDING FILE 
NAMES IN 
ARGUMENT LIST 



2220 



YES 




RUN 
INTERPRETER 
FOR PERL OR A 
SHELL, 
PROVIDING 
FILE NAME 
ARGUMENT 
LIST 



WHEN WRITING ISSUE OUTPUT OR ERR OUTPUT, CALL 
SUBROUTINE THAT NORMALIZES THE OUTPUT AS AN 
XML STRUCTURE (SEE APPENDIX F). ARGUMENTS 
PASSED TO THIS SUBROUTINE INCLUDE: 
THE ISSUE ID NUMBER; 
ZERO OR MORE ARGUMENTS FOR LATER 
INSERTION INTO ANALYZER ISSUE TEMPLATE; 
A SNIPPET TAKEN FROM THE COLLECTOR 
REPORT, OR ANY EXPLANATORY TEXT STRING, 
OR A NULL STRING. 



T 



TO FIG. 24 




Atty. Dkt. No. 10015199-1 



Appendix B 



First Pages and Claims of Related Continuation 
and Continuation-in-part Applications 



-39- 



011.1187090.1 




(19) United States 

(12) Patent Application Publication (io) Pub. No.: US 2002/0169734 Ai 

Giel et al. (43) Pub. Date: Nov. 14, 2002 



(54) APPARATUS AND METHOD FOR 

CAPTURING KNOWLEDGE THROUGH AN 
EXPERT INTERFACE 

(76) Inventors: Peter Van Giel, Mesnil-Saint-Blaise 
(BE); Michael Joseph Brandon, 
Marietta, GA (US); William Paul 
Wedlake, Suwanee, GA (US); Peter A. 
Put, St. Albert (CA); Adam M. Carr, 
Fort Collins, CO (US); Paul Edward 
Holland, Fort Collins, CO (US); Mark 
W. McDowell, Ft Collins, CO (US) 

Correspondence Address: 
HEWLETT-PACKARD COMPANY 
Intellectual Property Administration 
P. O. Box 272400 
Fort Collins, CO 80527-2400 (US) 

(21) Appl. No.: 10/152,556 



(22) Filed: May 21, 2002 

Related U.S. Application Data 

(63) Continuation of application No. 09/851,963, filed on 
May 10, 2001. 

Publication Classification 

(51) Int. CI. 7 G06F 17/00 

(52) U.S. CI 706/45; 707/100 



(57) 



ABSTRACT 



An apparatus and method is provided for auditing the 
configuration of an enterprise comprising the steps of: 
collecting information relating to the configuration of the 
enterprise, analyzing the configuration information based on 
expert knowledge; and providing the result of the analysis in 
the form of reports, and other results of the analyses. 
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What is claimed is: 

1. A method of creating analyzers that can identify issues 
arising in the nodes of an enterprise having data collectors 
comprising the steps of: 

for each of analyzer that is to be created, 

creating analyzer code that accepts the output of one or 
more collector types, performs computations to 
detect the presence of issues, and outputs identifiers 
of issues which are present, 

creating an issue template for each issue identifier 
defining an issue report, and 

creating a descriptor of the analyzer identifying the 
collectors whose output the analyzer code requires as 
input; and 

collecting the created elements of each analyzer into a 
database such that, when an analyzer is to be applied 
against the collector data for a node, the analyzer's 
descriptor is available to guide in the selection of 
collector data, the analyzer's code is available to guide 
in data analysis, and the issue templates are available to 
guide in the generation of any issue reports. 

2. A method in accordance with claim 1 wherein the step 
of creating an issue template includes the step of providing 
for the inclusion in at east one issue report the identity of a 
particular node where the issue is present. 

3. A method in accordance with claim 2 wherein the step 
of creating an issue template includes the step of creating 
within at least one issue template a position marker indicat- 
ing where the identity of a particular node is to be placed 
within the issue report. 

4. A method in accordance with claim 1 wherein at least 
some of the analyzer code is written in Java and/or an 
equivalent architecture independent language. 

5. A method in accordance with claim 4 wherein at least 
some of the analyzer code is written in C and/or C++ and/or 
in an equivalent conventional language. 

6. A method in accordance with claim 5 wherein at least 
some of the analyzer code is written in perl and/or kshell 
and/or an equivalent operating system shell language. 

7. A method in accordance with claim 4 wherein at least 
some of the analyzer code is written in perl and/or kshell 
and/or an equivalent operating system shell language. 

8. A method in accordance with claim 1 wherein at least 
some of the analyzer code is written in C and/or C++ and/or 
an equivalent conventional language. 

9. A method in accordance with claim 7 wherein at least 
some of the analyzer code is written in perl and/or kshell 
and/or an equivalent operating system shell language. 

10. A method in accordance with claim 1 wherein at least 
some of the analyzer code is written in perl and/or kshell 
and/or an equivalent operating system shell language. 

11. A method in accordance with claim 1 wherein the 
output data is presented in XML or an equivalent data base 
compatible web page format. 

12. A method in accordance with claim 1 wherein the 
descriptor is presented in XML or an equivalent data base 
compatible web page format. 

13. A system for detecting issues arising on the nodes of 
an enterprise having data collectors comprising: 

one or more analyzer programs that accept data from one 
or more collector types, that perform computations to 



detect the presence of issues, and that output identifiers 
of issues which are present; 

for each issue identifier, an issue report template; 

for each analyzer program, a descriptor identifying the 
collector types whose data the analyzer requires; 

an analyzer harness that can exercise a set of one or more 
analyzer programs against data gathered from a differ- 
ent node or set of nodes during each such exercise, 
providing each analyzer program with collector data 
designated by the analyzer's descriptor and gathered 
from the node or set of nodes under examination; and 

the analyzer harness responding to the output of issue 
identifiers by presenting reports formed in accordance 
with each issue identifier's issue report template. 

14. A system in accordance with claim 13 wherein the 
analyzer harness augments at least some issue reports with 
the identity of the particular node or set of nodes where the 
analyzer has determined the identified issue is present. 

15. A system in accordance with claim 14 wherein the 
issue report templates for at least some issue identifiers 
contain an indication of the position within an issue report 
where the analyzer harness is to insert the identity of the 
particular node or set of nodes where the analyzer has 
determined the identified issue is present. 

16. A system in accordance with claim 13 wherein at least 
some of the analyzer code is written in Java and/or an 
equivalent architecture independent language. 

17. A system in accordance with claim 16 wherein at least 
some of the analyzer code is written in C and/or C++ and/or 
in an equivalent conventional language. 

18. A system in accordance with claim 17 wherein at least 
some of the analyzer code is written in perl and/or kshell 
and/or an equivalent operating system shell language. 

19. A system in accordance with claim 16 wherein al least 
some of the analyzer code is written in perl and/or kshell 
and/or an equivalent operating system shell language. 

20. A system in accordance with claim 13 wherein al least 
some of the analyzer code is written in C and/or C++ and/or 
an equivalent conventional language. 

21. A system in accordance with claim 20 wherein at least 
some of the analyzer code is written in perl and/or kshell 
and/or an equivalent operating system shell language. 

22. A system in accordance with claim 13 wherein at least 
some of the analyzer code is written in perl and/or kshell 
and/or an equivalent operating system shell language. 

23. A system in accordance with claim 13 wherein the 
output data is presented in XML or an equivalent data-base 
compatible web page format. 

24. A system in accordance with claim 13 wherein the 
descriptor is written in XML or an equivalent data-base 
compatible web page format. 

25. A method of identifying the presence of issues through 
the analysis of output data provided by collectors monitoring 
the nodes of an enterprises, comprising the steps of: 

providing analyzer programs that define the steps of 
accept data from one or more collector types, perform- 
ing computations to detect the presence of issues, and 
that output identifiers of any issues which are present; 

for each issue output identifier, providing an issue tem- 
plate that defines an issue report for that issue; 
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for each analyzer program, providing a descriptor iden- 
tifying the collector types whose data the analyzer 
requires as its input; and 

repeatedly exercising a set of the analyzer programs 
against output data gathered from different nodes or 
sets of nodes, providing each analyzer program with 
data from the types of collectors designated by the 
program's descriptor; and 

when issue identifiers are generated, generating an issue 
report guided by the corresponding issue template. 

26. A method in accordance with claim 25 further includ- 
ing the step of inserting the node identity of the node or set 
of nodes where an issue arose into at least some of generated 
issue reports. 

27. A method in accordance with claim 26 which includes, 
in the step of providing the issue templates for at least some 
issues, the step of indicating within the issue template where 
the identity of the node or set of nodes under analysis may 
be inserted. 

28. A method in accordance with claim 25 wherein at least 
some of the analyzer code is written in Java and/or an 
equivalent architecture independent language. 

29. A method in accordance with claim 28 wherein at least 
some of the analyzer code is written in C and/or C++ and/or 
in an equivalent conventional language. 

30. A method in accordance with claim 29 wherein at least 
some of the analyzer code is written in perl and/or kshell 
and/or an equivalent operating system shell language. 

31. A method in accordance with claim 29 wherein at least 
some of the analyzer code is written in perl and/or kshell 
and/or an equivalent operating system shell language. 

32. A method in accordance with claim 25 wherein at least 
some of the analyzer code is written in C and/or C++ and/or 
an equivalent conventional language. 

33. A method in accordance with claim 32 wherein at least 
some of the analyzer code is written in perl and/or kshell 
and/or an equivalent operating system shell language. 



34. A method in accordance with claim 21 wherein at least 
some of the analyzer code is written in perl and/or kshell 
and/or an equivalent operating system shell language. 

35. A method in accordance with claim 21 wherein the 
output data is presented in XML or an equivalent data-base 
compatible web page format. 

36. A method in accordance with claim 21 wherein the 
descriptors are presented in XML or an equivalent data-base 
compatible web page format. 

37. A system for detecting issues arising on the nodes of 
an enterprise having data collector means for collecting 
enterprise state data comprising: 

one or more analyzer means for accepting data from one 
or more collector means, for performing computations 
to detect the presence of issues, and for outputting 
identifiers of issues which are present; 

for each issue identifier, issue report template means for 
defining the structure of an issue report; 

for each analyzer means, descriptor means for identifying 
at least the type of collector means whose data the 
analyzer means requires; 

analyzer harness means for exercising a set of one or more 
analyzer means against data gathered from a different 
node or set of nodes during each such exercise, for 
providing each analyzer means with data from collector 
means designated by the analyzer mean's descriptor 
means and gathered from the node or set of nodes under 
examination; and 

the analyzer harness means including means for respond- 
ing to the output of issue identifiers by presenting 
reports formed in accordance with each issue identifi- 
er's issue report template means. 

***** 
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(57) ABSTRACT 

In a system that uses collectors to gather data indicating the 
status of nodes in an enterprise, analyzers are provided to 
analyze the collector data. Each analyzer includes a program 
and an accompanying XML analyzer descriptor. Each ana- 
lyzer program is written in one of several programming 
language. Each descriptor identifys the types of collectors 
whose data the program accepts and also identifys the 
language in which the program is written. A framework 
exercises a set of one or more of these analyzer programs 
repeatedly, and during each such repetitive exercise of the 
set, presents the set of analyzers with collector output data 
gathered from a different specific set of one or more nodes. 
During each exercise of each analyzer program, the frame- 
work reviews the analyzer's descriptor and executes the 
program in a program execution environment appropriate to 
the language in which the program is written. The frame- 
work also notes the type of collectors whose data the 
program accepts and arranges to present this type of collec- 
tor data to the program as a data input stream during 
program execution or interpretation. 
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What is claimed is: 

1. In a system having collectors monitoring nodes, a 
method of analyzing collector data comprising the steps of: 

providing one or more programs and descriptors, called 
analyzers, each program comprising a set of instruc- 
tions written in a language chosen from a set of at least 
two languages and including instructions accepting and 
analyzing data from one or more collector types, and 
each descriptor comprising instructions written in XML 
or a comparable language identifying the types of 
collectors whose data the instructions accept and iden- 
tifying the program language; 

exercising a set of one or more of these analyzers repeat- 
edly one or more times, and during each such exercise 
presenting the set of analyzers with collector output 
data gathered from a different specific set of one or 
more nodes; and 

during each exercise of each analyzer, locating the ana- 
lyzer's descriptor and program, exercising the pro- 
gram's instructions in accordance with the require- 
ments of the program language identified by the 
descriptor, and when exercising instructions that accept 
and analyze collector data, exercising those instructions 
against data taken from collectors of the type identified 
by the descriptor. 

2. A method in accordance with claim 1 wherein the 
descriptors identify the type of instructions the correspond- 
ing analyzer program contains (e.g.: text, interpretable, 
object, etc.) and also where the analyzer program is to be 
found. 

3. A method in accordance with claim 1 wherein at least 
one of the languages in at least one analyzer program is Java 
and/or an equivalent architecture-independent interpretable 
language. 

4. A method in accordance with claim 3 wherein at least 
some of the languages in at least one analyzer program is C 
or C++ or an equivalent compilable programming language. 

5. A method in accordance with claim 4 wherein at least 
one of the languages in at least one analyzer program is perl 
or kshell or an equivalent operating system shell language. 

6. A method in accordance with claim 3 wherein at least 
one of the languages in at least one analyzer program is perl 
or kshell or an equivalent operating system shell language. 

7. A method in accordance with claim 1 wherein at least 
one of the languages in at least one analyzer program is C 
and/or C++ and/or an equivalent conventional language. 

8. A method in accordance with claim 7 wherein at least 
one of the languages in at least one analyzer program is perl 
or kshell or an equivalent operating system shell language. 

9. A method in accordance with claim 1 wherein at least 
one of the languages in al least one analyzer program is perl 
or kshell or an equivalent operating system shell language. 

10. A method in accordance with claim 1 wherein at least 
one analyzer descriptor further identifies the author of the 
code, the code version, and contains a summary description 
of the operations performed by the corresponding analyzer. 

11. A system that analyzes data gathered by collectors 
monitoring nodes, the system comprising: 

one or more analyzers each comprising a program written 
in one of several different languages and accepting and 
analyzing data from one or more types of collectors, 
and a descriptor written in XML or a comparable 



language identifying the collector types whose data the 
analyzer program accepts and the language in which 
the analyzer program is written; 

an analyzer framework that exercises a set of one or more 
analyzer programs repeatedly one or more times and 
that presents the set of analyzers, during each such 
repeated exercise of the set, with collector data gath- 
ered from a different specific set of one or more nodes; 

the analyzer framework including plural program execu- 
tion environments, at least one for each of the several 
different languages, and guided by the language iden- 
tified in each analyzer's descriptor, the framework 
executing each analyzer's program within the proper 
execution environment; and 

the analyzer framework including a collector data type 
selection mechanism that presents as a data input 
stream directed into the program execution environ- 
ment of each analyzer program data obtained from 
collectors of the types identified by the corresponding 
analyzer descriptor. 

12. A system in accordance with claim 11 wherein the 
analyzer descriptor further designates the program type 
(e.g.: text, interpretable, object, etc.) and where the analyzer 
program is to be found, and wherein the framework is 
further guided by this information in locating the analyzer 
program and in selecting an appropriate environment in 
which to exercising the analyzer program. 

13. A system in accordance with claim 11 wherein at least 
one or more of the analyzer programs are written in Java or 
an equivalent architecture-independent interpretable lan- 
guage. 

14. A system in accordance with claim 13 wherein at least 
one or more of the analyzer programs are written in C or 
C++ or an equivalent compilable language. 

15. A system in accordance with claim 14 wherein at least 
one or more of the analyzer programs are written in perl or 
kshell or an equivalent operating system shell language. 

16. A system in accordance with claim 13 wherein at least 
one or more of the analyzer programs are written in perl or 
kshell or an equivalent operating system shell language. 

17. A system in accordance with claim 11 wherein at least 
one or more of the analyzer programs are written in C or 
C++ or an equivalent compilable language. 

18. A system in accordance with claim 17 wherein at least 
one or more of the analyzer programs are written in perl or 
kshell or an equivalent operating system shell language. 

19. A system in accordance with claim 11 wherein at least 
one or more of the analyzer programs arc written in perl or 
kshell or an equivalent operating system shell language. 

20. A system in accordance with claim 1 wherein at least 
one analyzer descriptor further identifies the author of the 
code, the code version, and includes a summary description 
of the operations performed by the corresponding analyzer. 

21. A system that analyzes data gathered by collector 
means for monitoring nodes, the system comprising: 

one or more analyzer means for accepting and analyzing 
data from one or more types of collectors means, each 
analyzer means comprising a program written in one of 
several different languages, and each analyzer means 
further comprising a descriptor written in XML or a 
comparable language identifying at least the collector 
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means types whose data the analyzer means's program 
accepts and the language in which the analyzer means's 
program is written; 

analyzer framework means for exercising a set of one or 
more analyzer means repeatedly one or more times and 
for presenting the set of analyzer means, during each 
such repeated exercise of the set, with collector means 
data gathered from a different specific set of one or 
more nodes; 

the analyzer framework means including means for exer- 
cising plural different types of analyzer means pro- 
grams, at least one for each of the several different 



languages, and guided by the language identified in 
each analyzer's descriptor, the framework means 
including means for executing each analyzer mean's 
program within the proper execution environment; and 

the analyzer framework means including data type selec- 
tion means for selecting and presenting, as a data input 
stream directed into the program execution means, 
program data obtained from collector means of the 
types identified by the corresponding analyzer mean's 
descriptor. 

* * * * * 
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(57) ABSTRACT 

A method and apparatus is provided for auditing the con- 
figuration of an enterprise using low-level analyzers that 
include a program and a descriptor of the type of collector 
data the program can accept, and high-level analyzers that 
are descriptors which call upon, or incorporate by reference, 
other analyzer descriptors. A framework, guided by one or 
more analyzer descriptors and by any descriptors those 
descriptors may call upon or incorporate by reference, 
repeatedly executes the set of programs associated with 
some of the analyzer descriptors against a different node or 
nodes of an enterprise during each such execution. When 
executing a program, the framework provides the program 
with the collector data of the type designated by the descrip- 
tor associated with the program. 
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What is claimed is: 

1. In a system that analyzes data gathered by collectors 
monitoring nodes, a hierarchical method of defining and 
organizing the analysis tasks to be performed comprising the 
steps of: 

performing, for each low-level analysis task, analysis 
steps that comprise accepting data from one or more 
collector types, analyzing the data, and generating 
reports, guided by an analyzer descriptor written in 
XML or a comparable format identifying the collector 
types whose data the analyzer steps are to process; 

for each higher- level analysis task, of which there is at 
least one, performing one .or more sets of analysis steps 
for either low-level or high-level analysis tasks, guided 
by an analyzer descriptor written in XML or a compa- 
rable format that calls upon or that incorporates by 
reference other analyzer descriptors; and 

guided by one or more analyzer descriptors and, in the 
case of higher level analyzer descriptors, by the ana- 
lyzer descriptors they call upon or incorporate by 
reference directly or indirectly, repeatedly performing 
the set of analysis steps corresponding to one or more 
analyzer descriptors one or more times against collector 
data gathered from a different node or set of nodes 
during each such exercise of the set of analysis steps, 
and during this process, presenting for acceptance and 
analysis during the performance of each data accep- 
tance step data gathered from collectors of the type 
indicated by the guiding analyzer descriptors. 

2. A method in accordance with claim 1 wherein the step 
of obtaining an analyzer descriptor includes obtaining one or 
more such descriptors that contain an analyzer name, 
description, and in the case of at least one higher-level 
analyzer descriptor a list of the other analyzer names whose 
descriptors it calls upon or incorporates by reference. 

3. A method in accordance with claim 1 wherein the step 
of obtaining an analyzer descriptor for each higher-level task 
includes obtaining at least one analyzer descriptor for a 
higher-level task that calls upon or that incorporates by 
reference at least one other analyzer descriptor for another 
higher-level task. 

4. A method in accordance with claim 3 wherein the step 
of obtaining an analyzer descriptor includes obtaining one or 
more such descriptors that contain an analyzer name, 
description, and in the case of at least one higher-level 
analyzer descriptor a list of other analyzer names whose 
descriptors it calls upon or incorporates by reference. 

5. A method in accordance with claim 1 wherein the step 
of obtaining an analyzer descriptor for each higher- level task 
includes obtaining at least one analyzer descriptor for a 
higher-level task that calls upon or that incorporates by 
reference at least one other analyzer descriptor for another 
higher-level task which in turn calls upon or which incor- 
porates by reference at least one other analyzer descriptor for 
another higher-level task. 

6. A method in accordance with claim 5 wherein the step 
of obtaining an analyzer descriptor includes obtaining one or 
more such descriptors that contain an analyzer name, 
description, and in the case of at least one higher-level 
analyzer descriptor, a list of other analyzer names whose 
descriptors it calls upon or incorporate by reference. 

7. A method in accordance with claim 1 wherein the step 
of obtaining an analyzer descriptor for each higher-level task 



includes obtaining at least one analyzer descriptor for a 
higher-level task that calls upon or that incorporates by 
reference at least one other analyzer descriptor for another 
higher-level task which in turn calls upon or which incor- 
porates by reference at least one other analyzer descriptor for 
another higher- level task that calls upon or that incorporates 
by reference at least one other analyzer descriptor for 
another higher-level task. 

8. A method in accordance with claim 7 wherein the step 
of obtaining an analyzer descriptor includes obtaining one or 
more such descriptors that contain an analyzer name, 
description, and in the case of at least one higher-level 
analyzer descriptor, a list of other analyzer names whose 
descriptors it calls upon or incorporate by reference. 

9. A system that analyzes data gathered by one or more 
collectors monitoring one or more nodes, said system com- 
prising: 

for each low-level analysis task that the system performs, 
an analyzer program and an analyzer descriptor, the 
program containing instructions that accept data from 
one or more collector types, analyze the data, and 
generates reports, and the analyzer descriptor written in 
XML or a comparable format and identifying the 
collector types whose data the program's instructions 
can accept; 

for hierarchically higher-level analysis tasks, of which 
there is at least one, at least one analyzer program, and 
an analyzer descriptor for each of the higher-level tasks 
written in XML or a comparable format that calls upon, 
or that incorporates by reference, other analyzer 
descriptors; and 

a framework that is guided by a set of one or more 
analyzer descriptors and, in the case of hierarchically 
higher- level analyzer descriptors, by the analyzer 
descriptors they call upon or incorporate by reference 
directly or indirectly, to execute repeatedly one or more 
times the set of analyzer programs corresponding to 
some of these analyzer descriptors against collector 
data gathered from a different node or set of nodes 
during each such execution of the set of programs, and 
during each execution of each program, to present the 
program with only the type of collector data the instruc- 
tions of the executing program are designed to accept, 
as indicated by the analyzer descriptor corresponding to 
the executing program. 

10. A system in accordance with claim 9 wherein each 
analyzer descriptor contains an analyzer name, an analyzer 
description, and in the case of analyzer descriptors for 
higher-level analyzer tasks, a list of other analyzer names 
whose descriptors it calls upon or incorporates by reference. 

11. A system in accordance with claim 9 including at least 
one or more higher-level analyzer descriptor that calls upon, 
or that incorporates by reference, another high-level ana- 
lyzer descriptor. 

12. A system in accordance with claim 9 wherein each 
analyzer descriptor contains an analyzer name, an analyzer 
description, and in the case of analyzer descriptors for 
higher-level analyzer tasks, a list of other analyzer names 
whose descriptors it calls upon or incorporates by reference. 

13. A system in accordance with claim 9 including at least 
one or more higher-level analyzer descriptor that calls upon, 
or that incorporates by reference, another high-level ana- 
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lyzer descriptor which, in turn, also calls upon, or that 
incorporates by reference, yet another high-level analyzer 
descriptor. 

14. A system in accordance with claim 9 wherein each 
analyzer descriptor contains an analyzer name, an analyzer 
description, and in the case of analyzer descriptors for 
higher-level analyzer tasks, a list of other analyzer names 
whose descriptors it calls upon or incorporates by reference. 

15. A system in accordance with claim 9 including at least 
one or more higher-level analyzer descriptor that calls upon, 
or that incorporates by reference, another high-level ana- 
lyzer descriptor which, in turn, also calls upon, or that 
incorporates by reference, yet another high-level analyzer 
descriptor that, in turn, also calls upon, or that incorporates 
by reference, another high-level analyzer descriptor. 

16. A system in accordance with claim 9 wherein each 
analyzer descriptor contains an analyzer name, an analyzer 
description, and in the case of analyzer descriptors for 
higher-level analyzer tasks, a list of other analyzer names 
whose descriptors it calls upon or incorporates by reference. 

17. A system that analyzes data gathered by one or more 
collector means for monitoring one or more nodes, said 
system comprising: 

for each low-level analysis task that the system performs, 
an analyzer means for accepting data from one or more 
collector means, analyzing the data, and generating 
reports, and an analyzer descriptor written in XML or 
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a comparable format and identifying the types of col- 
lector means whose data the program's instructions can 
accept; 

for hierarchically higher-level analysis tasks, of which 
there is at least one, at least one analyzer means, and an 
analyzer descriptor written in XML or a comparable 
format for each of the higher-level analysis task that 
calls upon, or that incorporates by reference, other 
analyzer descriptors; and 

framework means guided by a set of one or more analyzer 
descriptors and, in the case of hierarchically higher- 
level analyzer descriptors, by the analyzer descriptors 
they call upon or incorporate by reference directly or 
indirectly, for executing repeatedly one or more times 
the set of analyzer means corresponding to some of 
these analyzer descriptors against collector means data 
gathered from a different node or set of nodes during 
each such execution of the set of analyzer means, and 
during each execution of each analyzer means, for 
presenting the analyzer means with only the type of 
collector means data the analyzer means are designed 
to accept, as indicated by the analyzer descriptor cor- 
responding to the executing analyzer means. 

* * * * * 
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ABSTRACT 



A computerized apparatus and method generates informa- 
tion descriptive of issues arising in a monitored set of nodes. 
The method comprises supplying one or more analyzer 
programs with node-specific information derived from one 
or more nodes. Each analyzer program is then caused to 
analyze at least some of the information provided from each 
node to detect the presence of one or more issues. When an 
issue is detected, the analyzer program is caused to generate 
issue identification information which is augmented with 
information identifying the node from which the node- 
specific information was derived. The augmented informa- 
tion for all the issues detected is presented in combined form 
as an issues database suitable for later use in report genera- 
tion. 
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What is claimed is: 

1. A computerized method for generating information 
descriptive of issues arising in a monitored set of nodes, said 
method comprising the steps of: 

supplying one or more analyzer programs with node- 
specific information derived from one or more nodes; 

causing each analyzer program to analyze at least some of 
the information provided from each node to detect the 
presence of one or more issues; 

when an issue is detected, causing the analyzer program 
to generate issue identification information; 

augmenting the issue identification information with 
information identifying the node from which the node- 
specific information was derived; and 

presenting the augmented information for all the issues 
detected in combined form as an issues database suit- 
able for later use in report generation. 

2. A computerized method in accordance with claim 1 
which further includes the step of augmenting the issue 
identification information with information descriptive of 
the issue identified. 

3. A computerized method in accordance with claim 2 
which further includes the step of having the analysis 
program generate at least some of the information descrip- 
tive of the issue identified, tailoring this information in 
accordance with the specifics of each occurrence of each 
issue. 

4. A computerized method in accordance with claim 2 
which further includes the step of formulating the informa- 
tion descriptive of the issues identified as templates. 

5. A computerized method in accordance with claim 4 
which further includes the steps of having at least some of 
the analyzer programs generate, in addition to issue identi- 
fication information, other issue-related information, includ- 
ing within at least some of the templates one or more 
spaceholders for issue-related information, and when such a 
template is used to augment issue identification information, 
replacing such spaceholders with this issue-related informa- 
tion. 

6. A computerized method for generating information in 
accordance with claim 1 which further includes the step of 
formatting the augmented information for all the issues 
detected in combined form as an issues database formatted 
as an XML or similar document. 

7. A computerized method for generating information in 
accordance with claim 6 which further includes the step of 
augmenting the issue identification information with infor- 
mation descriptive of the issue identified. 

8. A computerized method in accordance with claim 7 
which further includes the step of having the analysis 
program generate at least some of the information descrip- 
tive of the issue identified, tailoring this information in 
accordance with the specifics of each occurrence of each 
issue. 

9. A computerized method in accordance with claim 7 
which further includes the step of formulating the informa- 
tion descriptive of the issues identified as templates. 

10. A computerized method in accordance with claim 9 
which further includes the steps of having at least some of 
the analyzer programs generate, in addition to issue identi- 
fication information, other issue-related information, includ- 
ing within at least some of the templates one or more 



spaceholders for issue-related information, and when such a 
template is used to augment issue identification information, 
replacing such spaceholders with this issue-related informa- 
tion. 

11. A computerized method for generating information in 
accordance with claim 6 which further includes the step of 
formatting the issue identification information as an XML or 
similarly-formatted document. 

12. A computerized method for generating information in 
accordance with claim 11 which further includes the step of 
augmenting the issue identification information with infor- 
mation descriptive of the issue identified. 

13. A computerized method in accordance with claim 12 
which further includes the step of having the analysis 
program generate at least some of the information descrip- 
tive of the issue identified, tailoring this information in 
accordance with the specifics of each occurrence of each 
issue. 

14. A computerized method in accordance with claim 12 
which further includes the step of formulating the informa- 
tion descriptive of the issues identified as templates. 

15. A computerized method in accordance with claim 14 
which further includes the steps of having at least some of 
the analyzer programs generate, in addition to issue identi- 
fication information, other issue-related information, includ- 
ing within at least some of the templates one or more 
spaceholders for issue-related information, and when such a 
template is used to augment issue identification information, 
replacing such spaceholders with this issue -related informa- 
tion. 

16. A computerized method for generating information in 
accordance with claim 1 which further includes the step of 
formatting the issue identification information as an XML or 
similarly-formatted document. 

17. A computerized method for generating information in 
accordance with claim 16 which further includes the step of 
augmenting the issue identification information with infor- 
mation descriptive of the issue identified. 

18. A computerized method in accordance with claim 17 
which further includes the step of having the analysis 
program generate at least some of the information descrip- 
tive of the issue identified, tailoring this information in 
accordance with the specifics of each occurrence of each 
issue. 

19. A computerized method in accordance with claim 17 
which further includes the step of formulating the informa- 
tion descriptive of the issues identified as templates. 

20. A computerized method in accordance with claim 19 
which further includes the steps of having at least some of 
the analyzer programs generate, in addition to issue identi- 
fication information, other issue-related information, includ- 
ing within at least some of the templates one or more 
spaceholders for issue-related information, and when such a 
template is used to augment issue identification information, 
replacing such spaceholders with this issue-related informa- 
tion. 

21. A system for generating information descriptive of 
issues arising in a monitored set of nodes comprising: 

at least one analyzer program having provision to accept 
node-specific information, analyze the information for 
the presence of issues, and generate issue identification 
information when an issue is detected; 
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a harness that exercises one or more analyzer programs 
against node-specific information gathered from one or 
more nodes, presenting each analyzer program with at 
least some data from one of the nodes each time the 
program is exercised, and collecting any issue identi- 
fication information generated by the programs, said 
harness augmenting the issue identification information 
generated with information identifying the node from 
which the node-specific information was obtained; and 

an issues database containing the collected and aug- 
mented information for all the issues detected during 
such an exercising of the analyzer programs against 
node-specific information. 

22. A system in accordance with claim 21 wherein the 
harness also augments the issue identification information 
with information descriptive of the issue identified. 

23. A system in accordance with claim 22 wherein the 
analyzer programs also have provision to generate at least 
some of the information descriptive of the issue identified, 
tailoring this information in accordance with the specifics of 
each occurrence of each issue. 

24. A system in accordance with claim 22 wherein tem- 
plates provide the information descriptive of the issues. 

25. A system in accordance with claim 24 wherein the 
analyzer programs also have provision to generate, in addi- 
tion to issue identification information, other issue-related 
information, including, wherein at least some of the tem- 
plates contain one or more spaceholders for issue-related 
information, and wherein the harness inserts such issue- 
related information generated by an analyzer program into 
the template for an issue at positions indicated by the 
spaceholders. 

26. a system in accordance with claim 21 wherein the 
issues database is formulated as an XML or similar docu- 
ment. 

27. A system in accordance with claim 26 wherein the 
harness also augments the issue identification information 
with information descriptive of the issue identified. 

28. A system in accordance with claim 27 wherein the 
analyzer programs also have provision to generate at least 
some of the information descriptive of the issue identified, 
tailoring this information in accordance with the specifics of 
each occurrence of each issue. 

29. A system in accordance with claim 27 wherein tem- 
plates provide the information descriptive of the issues. 

30. A system in accordance with claim 29 wherein the 
analyzer programs also have provision to generate, in addi- 
tion to issue identification information, other issue-related 
information, including, wherein at least some of the tem- 
plates contain one or more spaceholders for issue-related 
information, and wherein the harness inserts such issue- 
related information generated by an analyzer program into 
the template for an issue at positions indicated by the 
spaceholders. 

31. A system in accordance with claim 26 wherein an 
output routine formulates the issue identification informa- 
tion generated by the analysis programs as an XML or 
similar document. 

32. A system in accordance with claim 31 wherein the 
harness also augments the issue identification with informa- 
tion descriptive of the issue identified. 



33. A system in accordance with claim 32 wherein the 
analyzer programs also have provision to generate at least 
some of the information descriptive of the issue identified, 
tailoring this information in accordance with the specifics of 
each occurrence of each issue. 

34. A system in accordance with claim 32 wherein tem- 
plates provide the information descriptive of the issues. 

35. A system in accordance with claim 34 wherein the 
analyzer programs also have provision to generate, in addi- 
tion to issue identification information, other issue-related 
information, including, wherein at least some of the tem- 
plates contain one or more spaceholders for issue-related 
information, and wherein the harness inserts such issue- 
related information generated by an analyzer program into 
the template for an issue at positions indicated by the 
spaceholders. 

36. A system in accordance with claim 21 wherein an 
output routine formulates the issue identification informa- 
tion generated by the analysis programs as an XML or 
similar document. 

37. A system in accordance with claim 36 wherein the 
harness also augments the issue identification information 
with information descriptive of the issue identified. 

38. A system in accordance with claim 37 wherein the 
analyzer programs also have provision to generate at least 
some of the information descriptive of the issue identified, 
tailoring this information in accordance with the specifics of 
each occurrence of each issue. 

39. A system in accordance with claim 37 wherein tem- 
plates provide the information descriptive of the issues. 

40. A system in accordance with claim 39 wherein the 
analyzer programs also have provision to generate, in addi- 
tion to issue identification information, other issue-related 
information, including, wherein at least some of the tem- 
plates contain one or more spaceholders for issue-related 
information, and wherein the harness inserts such issue- 
related information generated by an analyzer program into 
the template for an issue at positions indicated by the 
spaceholders. 

41. A system for generating information descriptive of 
issues arising in a monitored set of nodes comprising: 

at least one analyzer means for accepting node-specific 
information, analyzing the information for the presence 
of issues, and generating issue identification informa- 
tion when an issue is detected; 

harness means for exercising one or more analyzer means 
against node-specific information gathered from one or 
more nodes, presenting each analyzer means with at 
least some data from one of the nodes each time the 
analyzer means is exercised, and collecting any issue 
identification information generated by the analyzer 
means, said harness means also including means for 
augmenting the issue identification information gener- 
ated with information identifying the node from which 
the node-specific information was obtained; and 

an issues database containing the collected and aug- 
mented information for all the issues detected during 
such an exercising of the analyzer means against node- 
specific information. 
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(57) ABSTRACT 

A method is provided for auditing the configuration of an 
enterprise comprising the steps of: collecting information 
relating to the configuration of the enterprise, analyzing the 
configuration information based on expert knowledge; and 
providing the result of the analysis in the form of reports, 
and other results of the analyses. 
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What is claimed is: 

1. A set of one or more analyzers to govern the analysis 
of information gathered from nodes or groups of nodes as 
well as the selective production of issue information, the 
analyzers comprising: 

one or more analyzers which govern the analysis of 
specific configuration information to determine 
whether the software and/or the hardware associated 
with a node and/or a group of nodes is configured 
properly; 

one or more analyzers which govern the analysis of 
specific information resulting from testing to determine 
whether the tested software and/or hardware associated 
with a node and/or a group of nodes is functioning 
properly; 

one or more analyzers which govern the analysis of 
specific diagnostic and/or log information to determine 
whether the software and/or the hardware associated 
with a node and/or a group of nodes is functioning 
properly; and 

these analyzers also govern the determination of whether 
and, if so, of what specific issue information is to be 
produced. 

2. A set of one or more analyzers in accordance with claim 
1, further comprising: 

a harness or framework which, when provided with a list 
of one or more of the analyzers and with a list of one 
or more nodes or groups of nodes, exercises one or 
more of the analyzers against specific data associated 
with each node or group of nodes, captures any issue 
information produced, and augments such issue infor- 
mation with node identification information to produce 
an issues database. 

3. A set of one or more analyzers in accordance with claim 
1 wherein at least some analyzers include a code portion and 
a descriptor portion, the descriptor portion containing infor- 
mation identifying at least some of the specific node infor- 
mation required for the performance of the analysis defined 
by the code portion. 

4. Asel of one or more analyzers in accordance with claim 
3 wherein at least some analyzers further include a template 
portion, the template portion defining the format of at least 
some specific issue information that may be generated as a 
result of the performance of the analysis defined by the code 
portion. 

5. A set of one or more analyzers in accordance with claim 
1 wherein at least some analyzers include a code portion and 
a template portion, the template portion defining the format 
of at least some specific issue information that may be 
generated as a result of the performance of the analysis 
defined by the code portion. 

6. A set of one or more analyzers in accordance with claim 
1 wherein the analyzers which govern the analysis of 
specific configuration information include: 

at least one analyzer that analyzes the primary and sec- 
ondary boot disks of one or more nodes, insuring that 
the boot disks are not installed on the same path and 
that their configurations are logical. 

7. A set of one or more analyzers in accordance with claim 
1 wherein the analyzers which govern the analysis of 
specific configuration information include: 



at least one analyzer that analyzes the standard and 
backup kernel files of one or more nodes, insuring that 
the kernel files are not installed on the same path and 
that their configurations are logical. 

8. A set of one or more analyzers in accordance with claim 
1 wherein the analyzers which govern the analysis of 
specific configuration information include: 

at least one analyzer that analyzes the configuration of 
service guard or equivalent software which software 
performs functional analyses of at least one mission 
critical switch guard or equivalent node cluster and 
which software switches one or more tasks from node 
to node within such a cluster to keep mission critical 
tasks running. 

9. A set of one or more analyzers in accordance with claim 
1 wherein the analyzers which govern the analysis of 
specific configuration information include: 

at least one analyzer that analyzes the configuration of one 
or more hardware devices associated with a node or 
group of nodes. 

10. A set of one or more analyzers in accordance with 
claim 1 wherein the analyzers which govern the analysis of 
specific configuration information include: 

at least one analyzer that analyzes the system dump 
configurations of one or more nodes to see that the 
nodes are configured correctly to enable the perfor- 
mance of a successful system dump in case of a system 
crash or other failure. 

11. A set of one or more analyzers in accordance with 
claim 1 wherein the one or more analyzers which govern the 
analysis of specific diagnostic and/or log information 
include: 

at least one analyzer that analyzes memory error indica- 
tion information from one or more nodes to determine 
if memory error conditions are present and, if so, are 
serious enough to require attention. 

12. A set of one or more analyzers in accordance with 
claim 1 wherein the one or more analyzers which govern the 
analysis of specific diagnostic and/or log information 
include: 

at least one analyzer that analyzes at least some data 
retrieved from a circular buffer containing diagnostic 
information and/or error messages. 

13. A set of one or more analyzers in accordance with 
claim 1 wherein the one or more analyzers which govern the 
analysis of specific diagnostic and/or log information 
include: 

at least one analyzer that analyzes system logging file 
entries. 

14. A set of one or more analyzers in accordance with 
claim 1 wherein the one or more analyzers which govern the 
analysis of specific diagnostic and/or log information 
include: 

at least one analyzer that analyzes an error log of I/O 
errors. 

15. A set of one or more analyzers in accordance with 
claim 1 wherein the one or more analyzers which govern the 
analysis of specific diagnostic and/or log information 
include: 
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at least one analyzer that examines and analyzes infor- 
mation extracted from CPU hardware logs of each 
processor installed upon a node. 

16. A set of one or more analyzers in accordance with 
claim 1 wherein the one or more analyzers that govern the 
analysis of specific information resulting from testing 
includes: 

at least one analyzer which analyzes disk usage data to 
determine the likelihood of "disk full" conditions 
occurring soon. 

17. A set of one or more analyzers in accordance with 
claim 1 wherein the one or more analyzers that govern the 
analysis of specific information resulting from testing 
includes: 

at least one analyzer which analyzes data indicating 
whether the service guard related daemons or their 
equivalents are operating properly to insure the con- 
tinuance of mission critical tasks. 

18. A set of one or more analyzers in accordance with 
claim 1 wherein the one or more analyzers that govern the 
analysis of specific information resulting from testing 
includes: 

at least one analyzer which analyzes the operational status 
of at least one service guard or equivalent cluster of 
nodes, signaling an issue if such a cluster is down, or 
if one or more tasks of such a cluster is not running, or 
if no alternative node is available to which one or more 
tasks may be switched. 

19. A set of one or more analyzers in accordance with 
claim 1 wherein the one or more analyzers that govern the 
analysis of specific information resulting from testing 
includes: 

at least one analyzer which analyzes the status of one or 
more file systems. 

20. A set of one or more analyzers in accordance with 
claim 1 wherein the one or more analyzers that govern the 
analysis of specific information resulting from testing 
includes: 

at least one analyzer which data relating to the CPUs to 
determine if any have been de-configured. 

21. A set of one or more analyzers in accordance with 
claim 1 wherein the one or more analyzers that govern the 
analysis of specific information resulting from testing 
includes: 

at least one analyzer which analyzes the status of the CPU 
fans. 

22. A set of one or more analyzers in accordance with 
claim 1 wherein the one or more analyzers that govern the 
analysis of specific information resulting from testing 
includes: 

at least one analyzer which analyzes the status of the CPU 
power supplies. 

23. A set of one or more analyzers in accordance with 
claim 1 wherein the one or more analyzers that govern the 
analysis of specific information resulting from testing 
includes: 

at least one analyzer which analyzes the output generated 
by i/o device scans. 



24. A method of analyzing information gathered from 
nodes or groups of nodes and selectively producing issue 
information, the method comprising: 

analyzing one or more specific sets of configuration 
information to determine whether the software and/or 
the hardware associated with a node and/or a group of 
nodes is configured properly; 

analyzing one or more specific sets of information result- 
ing from testing to determine whether the tested soft- 
ware and/or hardware associated with a node and/or a 
group of nodes is functioning properly; 

analyzing one or more sets of specific diagnostic and/or 
log information to determine whether the software 
and/or the hardware associated with a node and/or a 
group of nodes is functioning properly; and 

determining whether and, if so, what specific issue infor- 
mation is to be produced as a result of these analyses, 
and producing that issue information. 

25. A method of analyzing in accordance with claim 24, 
further comprising: 

providing a list of one or more analyses and a list of one 
or more nodes or groups of nodes; 

performing one or more of the listed analyses against 
specific data gathered from each listed node or group of 
nodes; and 

capturing any issue information produced and augment- 
ing such issue information with node identification 
information to produce an issues database. 

26. Amethod of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more specific 
sets of configuration information includes: 

analyzing the primary and secondary boot disks of one or 
more nodes to insure that the boot disks are not 
installed on the same path and that their configurations 
are logical. 

27. Amethod of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more specific 
sets of configuration information includes: 

analyzing the standard and backup kernel files of one or 
more nodes to insure that the kernel files are not 
installed on the same path and that their configurations 
are logical. 

28. Amethod of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more specific 
sets of configuration information includes: 

analyzing the configuration of service guard or equivalent 
software which software performs functional analyses 
of at least one mission critical switch guard or equiva- 
lent node cluster and which software switches one or 
more tasks from node to node within such a cluster to 
keep mission critical tasks running. 

29. Amethod of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more specific 
sets of configuration information additionally comprises: 

analyzing the configuration of one or more hardware 
devices associated with a node or group of nodes. 

30. Amethod of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more specific 
sets of configuration information additionally comprises: 
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analyzing the system dump configurations of one or more 
nodes to see that the nodes are configured correctly to 
enable the performance of a successful system dump in 
case of a system crash or other failure. 

31. A method of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more sets of 
specific diagnostic and/or log information aditionally com- 
prises: 

analyzing memory error indication information from one 
or more nodes to determine if memory error conditions 
are present and, if so, are serious enough to require 
attention. 

32. A method of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more sets of 
specific diagnostic and/or log information additionally com- 
prises: 

analyzing at least some data retrieved from a circular 
buffer containing diagnostic information and/or error 
messages. 

33. A method of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more sets of 
specific diagnostic and/or log information additionally com- 
prises: 

analyzing system logging file entries. 

34. A method of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more sets of 
specific diagnostic and/or log information additionally com- 
prises: 

analyzing an error log of I/O errors. 

35. A method of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more sets of 
specific diagnostic and/or log information comprises: 

analyzing information extracted from CPU hardware logs 
of each processor installed upon a node. 

36. A method of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more specific 
sets of information resulting from testing additionally com- 
prises: 

analyzing disk usage data to determine the likelihood of 
"disk full" conditions occurring soon. 

37. A method of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more specific 
sets of information resulting from testing additionally com- 
prises: 

analyzing data indicating whether the service guard 
related daemons or their equivalents are operating 
properly to insure the continuance of mission critical 
tasks. 

38. A method of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more specific 
sets of information resulting from testing additionally com- 
prises: 

analyzing the operational status of at least one service 
guard or equivalent cluster of nodes, signaling an issue 



if such a cluster is down, or if one or more tasks of such 
a cluster is not running, or if no alternative node is 
available to which one or more tasks may be switched. 

39. A method of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more specific 
sets of information resulting from testing additionally com- 
prises: 

analyzing the status of one or more file systems. 

40. A method of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more specific 
sets of information resulting from testing additionally com- 
prises: 

analyzing data relating to the CPUs to determine if any 
have been de-configured. 

41. A method of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more specific 
sets of information resulting from testing additionally com- 
prises: 

analyzing the status of the CPU fans. 

42. A method of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more specific 
sets of information resulting from testing additionally com- 
prises: 

analyze the status of the CPU power supplies. 

43. A method of analyzing information in accordance with 
claim 24 wherein the step of analyzing one or more specific 
sets of information resulting from testing additionally com- 
prises: 

analyzing the output generated by i/o device scans. 

44. A set of one or more analyzers to govern the analysis 
of information gathered from nodes or groups of nodes as 
well as the selective production of issue information, the 
analyzers comprising: 

one or more configuration information analyzer means for 
analyzing specific configuration information to deter- 
mine whether the software and/or the hardware asso- 
ciated with a node and/or a group of nodes is configured 
properly; 

one or more test information analyzer means for analyz- 
ing specific information resulting from testing to deter- 
mine whether the tested software and/or hardware 
associated with a node and/or a group of nodes is 
functioning properly; 

one or more diagnostic and/or log information analyzer 
means for analyzing specific diagnostic and/or log 
information to determine whether the software and/or 
the hardware associated with a node and/or a group of 
nodes is functioning properly; and 

issue information production means for determining 
whether and, if so, for determining what specific issue 
information is to be produced. 

***** 
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What is claimed is: 

1. A method of generating a variety of reports descriptive 
of issues arising in monitored nodes of an enterprise or 
group of nodes, said method comprising the steps of: 

analyzing node-specific information derived from one or 
more nodes, guided by rules of analysis, to detect the 
presence of one or more issues; 

presenting at least some issue identification information 
together with node identification information; 

providing several report template and/or rule sets each set 
defining the organization and contents of a class of 
reports; and 

using two or more of these report templates and/or rule 
sets as a guide, and also guided by enterprise, node 
group, and/or node information that includes at least 
some of said issue and node identification information, 
generating two or more reports that present the infor- 
mation arranged, summarized, and/or supplemented in 
ways that suit the specialized needs of different audi- 
ences. 

2. A method in accordance with claim 1 which includes 
the steps of providing at least one master report template 
and/or rule set directed to a particular audience and business 
need that includes varying combinations of subsidiary 
reports defined by other report templates and/or rule sets as 
well as introductory and explanatory information, and under 
its guidance generating at least one such master report. 

3. A method in accordance with claim 1 wherein the 
method includes the steps of 

providing at least one management summary report tem- 
plate and/or rule set, and 

under its guidance generating one or more management 
summary reports that indicate, in a readable format, the 
general state of the enterprise or group of nodes. 

4. A method in accordance with claim 1 wherein the 
method includes the steps of 

providing at least one technical management summary 
report template and/or rule set, and 

under its guidance generating one or more technical 
reports that list critical points in summary form. 

5. A method in accordance with claim 4 wherein the 
method includes the step of providing within at least one 
such technical management summary report, in addition to 
the list of critical points, statements of their degrees of 
criticality. 

6. A method in accordance with claim 4 wherein the 
method includes the step of providing within at least one 
such technical management summary report, in addition to 
the list of critical points, cost estimates for their resolution. 

7. A method in accordance with claim 1 wherein the 
method includes the steps of 

providing at least one technical detail report template 
and/or rule set, and 

under its guidance generating one or more technical detail 
reports that state in detailed form at least some the 
specific issues for each of the nodes or group of nodes. 

8. A method in accordance with claim 7 wherein the 
method includes the step of providing within at least one 



such technical detail report at least some snippets of node- 
specific information as needed to clarify an issue. 

9. A method in accordance with claim 7 wherein the 
method includes the step of providing within at least one 
such technical detail report the motivation and/or the costs 
to address at least some issues. 

10. A method in accordance with claim 7 wherein the 
method includes the step of providing within at least one 
such technical detail report details relating to at least some 
issues. 

11. A system that generates a variety of reports descriptive 
of issues arising in the monitored nodes of an enterprise or 
group of nodes, said system comprising: 

several analyzers which, when presented with data 
derived from a node, and when exercised under the 
guidance of rules of analysis, analyze the node data and 
generate output data signaling the presence of one or 
more issues indicated by the analysis; 

a harness which exercises at least some the analyzers, 
providing them during each exercise with data gathered 
from a different node or group of nodes, and that 
presents issue data generated by an analyzer together 
with data identifying the node or group of nodes where 
the issue originated, to thereby generate an issues 
database; 

report templates and/or rule sets each defining the orga- 
nization and contents of a class of reports; and 

a report generator guided by two or more report templates 
and/or rule sets and by data retrieved from the issues 
database through the process of generating two or more 
reports that present the information arranged, summa- 
rized, and/or supplemented in ways that suit the spe- 
cialized needs of different audiences. 

12. A system in accordance with claim 11 which further 
includes at least one master report template and/or rule set 
directed to a particular audience and business need that 
includes varying combinations of subsidiary reports defined 
by other templates and/or rule sets as well as introductory 
and explanatory information. 

13. A system in accordance with claim 11 which further 
includes at least one management summary report template 
and/or rule set designed to be readable and to present the 
general state of the enterprise or group of nodes. 

14. A system in accordance with claim 11 which further 
includes at least one technical management summary report 
template and/or rule set designed to list critical points in 
summary form. 

15. A system in accordance with claim 14 in which at least 
one such technical management summary report, in addition 
to the list of critical points, contains statements of their 
degrees of criticality. 

16. A system in accordance with claim 14 in which at least 
one such technical management summary report, in addition 
to the list of critical points, contains cost estimates. 

17. A system in accordance with claim 11 which further 
includes at least one technical detail report template and/or 
rule set containing one or more technical detail reports 
capable of stating in detailed form at least some of the 
specific issues that may arise at each of the different nodes 
or group of nodes. 
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18. A system in accordance with claim 17 in which at least 
one such technical detail report contains at least some 
snippets of node-specific information as needed to clarify an 
issue that may arise. 

19. A system in accordance with claim 17 in which at least 
one such technical detail report contains the motivations 
and/or the costs to address at least some of the issues that 
may arise. 

20. A system in accordance with claim 17 in which at least 
one such technical detail report contains the details of at 
least some issues that may arise. 

21. Asystem that generates a variety of reports descriptive 
of issues arising in the monitored nodes of an enterprise or 
group of nodes, said system comprising: 

several analyzer means, designed to accept data derived 
from a node, for analyzing the node data, and for 
generating output data signaling the presence of one or 
more issues indicated by the analysis; 



harness means for exercising at least some the analyzers, 
for providing them during each exercise with data 
gathered from a different node or group of nodes, and 
for presenting issue data generated by an analyzer 
together with data identifying the node or group of 
nodes where the issue originated, thereby generating an 
issues database; 

report template and/or rule set means for defining the 
organization and contents of a class of reports; and 

report generator means guided by two or more report 
templates and/or rule sets and by data retrieved from 
the issues database for generating two or more reports 
that present the information arranged, summarized, 
and/or supplemented in ways that suit the specialized 
needs of different audiences. 
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What is claimed is: 

1. A system that analyzes data gathered from plural nodes, 
the system comprising: 

a set of two or more analyzers designed by technical 
experts, each analyzer defining how to analyze specific 
information to determine whether and what analysis 
result information is to be produced; and 

a harness accepting as input a list of analyzers and a list 
of nodes to be analyzed, the harness comprising 

an analyzer loader that proceeds through the lists of 
analyzers and nodes, loading at least some of the 
analyzers to govern the analysis of each of the nodes, 

an argument manager called upon by the analyzer 
loader during each analysis to gather the specific 
information from the node being analyzed for pre- 
sentation to the analysis process, and 

an output routine associated with the analyzer loader 
that receives any analysis result information pro- 
duced and places it into at least one of a database or 
an XML (or equivalent) record, associating such 
information with the identity of the node being 
analyzed. 

2. A system in accordance with claim 1 wherein the 
system is designed to analyze plural nodes on one or more 
enterprises, and wherein the list of nodes to be analyzed can 
be identified to the harness by the names of one or more 
enterprises some or all of whose nodes are to be analyzed. 

3. A system in accordance with claim 2 wherein the 
harness is designed to proceed from one enterprise to the 
next; and 

when analyzing one enterprise, the analyzer loader loads 
the analyzers in sequence and then exercises each 
analyzer repeatedly one or more times to analyze the 
one or more nodes of that enterprise which are to be 
analyzed by that analyzer. 

4. A system in accordance with claim 1 wherein the 
analyzer loader loads the analyzers in sequence and then 
exercises each analyzer repeatedly one or more times to 
analyze the one or more nodes which are to be analyzed by 
that analyzer. 

5. A system in accordance with claim 1 wherein the output 
routine formats result information as at least one XML (or 
equivalent) record which record is then expanded to include 
other information, including node identification information, 
such that an XML (or equivalent) report containing any 
analysis result information is generated. 

6. A system in accordance with claim 5 wherein an 
analyzer issue template, associated with at least some ana- 
lyzers, is incorporated into the XML (or equivalent) records 
that form the XML (or equivalent) report. 

7. A system in accordance with claim 1 which further 
comprises: 

a descriptor for each analyzer describing the specific 
information analyzed by the analyzer; and 

wherein the argument manager is guided by these descrip- 
tors to gather the correct specific information from the 
nodes during the analysis process. 
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8. A system in accordance with claim 7 wherein: 

the descriptor designates for each analyzer in which of 
several possible programming languages the analyzer 
is written; and 

the analyzer loader varies the specific way in which it 
carries out the analysis process in accordance with the 
programming language of each analyzer. 

9. A system in accordance with claim 1 which further 
comprises: 

a report generator including report template or rule set or 
both which, guided by the analyses result information 
generated, generate a variety of reports for varying 
audiences. 

10. A system in accordance with claim 1 which further 
comprises 

a tracker database containing a historical record of spe- 
cific information gathered from specific nodes at spe- 
cific times or on specific dates or both; 

the harness also accepts as input an indication of the 
specific times at which or the specific dates upon which 
(or both) the node information to be analyzed was 
gathered; 

the argument manager gathers the specific information 
from records gathered at those specifric times or on 
those specific dates or both; and 

the output routine also associates such analysis result 
information with the times at which or dates upon 
which (or both) the information was gathered. 

11. A method for analyzing data gathered from plural 
nodes, the method comprising the steps of: 

creating two or more analyzers, each analyzer defining 
how to analyze specific information to determine 
whether and what analysis result information is to be 
produced by the analyses; 

guided by lists of analyzers and of nodes to be analyzed, 
performing at least some of the analyses defined by the 
analyzers with respect to each of the nodes; 

during each analysis, gathering from the node under 
analysis the specific information required for the analy- 
sis; and 

receiving any analysis result information produced during 
the analyses and placing it into at least one of a 
database or an XML (or equivalent) record, and asso- 
ciating this information with the identity of the node 
which is under analysis. 

12. A method in accordance with claim 11 which includes 
the step of identiying the list of nodes to be analyzed by 
reference to the names of one or more enterprises some or 
all of whose nodes are to be analyzed, 

13. A method in accordance with claim 12 wherein the 
analysis proceeds first from one enterprise to the next; and 
secondly, when preceding with the nodes of an enterprise, it 
proceeds from one analyzer to the next in sequence and 
performs each analysis repeatedly one or more times to 
analyze the one or more nodes of that enterprise which are 
to be analyzed by that analyzer. 

14. A method in accordance with claim 11 wherein the 
analysis proceeds from one analyzer to the next in sequence 
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and performs each analysis repeatedly one or more times to 
analyze the one or more nodes which are to be analyzed by 
that analyzer. 

15. A method in accordance with claim 11 which includes 
the step of formatting the result information as at least one 
XML (or equivalent) record, and then expanding that record 
to include other information, including node identification 
information, such that an XML (or equivalent) record con- 
taining any analysis result information is generated. 

16. A method in accordance with claim 15 wherein the 
creation of at least some analyzers includes the creation of 
at least one analyzer issue template which is incorporated 
into the XML (or equivalent) records that form the XML (or 
equivalent) record. 

17. A system in accordance with claim 11 wherein the 
creation of at least some analyzers includes the creation of 
a descriptor identifying the specific information to be ana- 
lyzed by the analyzer; and 

wherein these descriptors guide the gathering step. 

18. A system in accordance with claim 17 wherein the 
creation step includes placing into at least some descriptors 
a designation of which of several possible programming 
languages the analyzer's analysis is written in; and 

wherein the analysis process is varied in accordance with 
the programming language selected for each analyzer. 

19. A system in accordance with claim 11 which further 
comprises the step of: 

creating a variety of report template or rule sets or both; 
and 

guided guided by these sets and the analyses result 
information record, generating a variety of reports. 

20. A system in accordance with claim 11 which further 
comprises the steps of 



providing a historical record of specific information gath- 
ered from specific nodes at specific times or on specific 
dates or both; 

during each analysis, gathering from the node under 
analysis the specific information for specified times or 
specific dates (or both) or ranges thereof at which time 
or upon which dates (or both) the specific node infor- 
mation to be analyzed was gathered; and 

associating any analysis result information with the times 
at which or the dates upon which (or both) the specific 
information was gathered. 
21. A system that analyzes data gathered from plural 
nodes, the system comprising: 

analyzer means for defining how specific information is to 
be analyzed to determine whether and what analysis 
result information is to be produced; and 

a harness accepting as input a list of analyzers and a list 
of nodes to be analyzed, the harness comprising 

analyzer loader means for proceeds through the lists of 
analyzers and nodes, causing al least some of the 
analyzers to govern the analysis of each of the nodes, 

argument manager means called upon by the analyzer 
loader during each analysis for gathering the specific 
information from the node being analyzed for pre- 
sentation to the analysis process, and 

output routine means associated with the analyzer 
loader for receiving any analysis result information 
produced and for placing it into at least one of a 
database or an XML (or equivalent) record, associ- 
ating such information with the identity of the node 
being analyzed. 

* * * * * 



